From 3afff1bae9e96c02486e8e8906378ba74cc53bb7 Mon Sep 17 00:00:00 2001 From: Jens L Date: Wed, 30 Aug 2023 17:27:40 +0200 Subject: [PATCH] providers/oauth2: fix incorrect scope permissions shown (#6696) Signed-off-by: Jens Langhammer --- authentik/providers/oauth2/views/authorize.py | 4 +++- authentik/providers/oauth2/views/device_init.py | 2 +- authentik/providers/oauth2/views/userinfo.py | 8 ++++++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/authentik/providers/oauth2/views/authorize.py b/authentik/providers/oauth2/views/authorize.py index fd3851285..8c31192bf 100644 --- a/authentik/providers/oauth2/views/authorize.py +++ b/authentik/providers/oauth2/views/authorize.py @@ -375,7 +375,9 @@ class AuthorizationFlowInitView(PolicyAccessView): ): self.request.session[SESSION_KEY_LAST_LOGIN_UID] = login_uid return self.handle_no_permission() - scope_descriptions = UserInfoView().get_scope_descriptions(self.params.scope) + scope_descriptions = UserInfoView().get_scope_descriptions( + self.params.scope, self.params.provider + ) # Regardless, we start the planner and return to it planner = FlowPlanner(self.provider.authorization_flow) planner.allow_empty_flows = True diff --git a/authentik/providers/oauth2/views/device_init.py b/authentik/providers/oauth2/views/device_init.py index c9f240661..947ee1cde 100644 --- a/authentik/providers/oauth2/views/device_init.py +++ b/authentik/providers/oauth2/views/device_init.py @@ -55,7 +55,7 @@ def validate_code(code: int, request: HttpRequest) -> Optional[HttpResponse]: if not app: return None - scope_descriptions = UserInfoView().get_scope_descriptions(token.scope) + scope_descriptions = UserInfoView().get_scope_descriptions(token.scope, token.provider) planner = FlowPlanner(token.provider.authorization_flow) planner.allow_empty_flows = True try: diff --git a/authentik/providers/oauth2/views/userinfo.py b/authentik/providers/oauth2/views/userinfo.py index 2f9b118a4..061e43fc8 100644 --- a/authentik/providers/oauth2/views/userinfo.py +++ b/authentik/providers/oauth2/views/userinfo.py @@ -40,10 +40,14 @@ class UserInfoView(View): token: Optional[RefreshToken] - def get_scope_descriptions(self, scopes: list[str]) -> list[PermissionDict]: + def get_scope_descriptions( + self, scopes: list[str], provider: OAuth2Provider + ) -> list[PermissionDict]: """Get a list of all Scopes's descriptions""" scope_descriptions = [] - for scope in ScopeMapping.objects.filter(scope_name__in=scopes).order_by("scope_name"): + for scope in ScopeMapping.objects.filter(scope_name__in=scopes, provider=provider).order_by( + "scope_name" + ): scope_descriptions.append(PermissionDict(id=scope.scope_name, name=scope.description)) # GitHub Compatibility Scopes are handled differently, since they required custom paths # Hence they don't exist as Scope objects